1. Field of the Invention
This invention relates to a method and apparatus for cryptographically transforming an input block into an output block and, more particularly, to a method and apparatus for encrypting or decrypting an input block using a symmetric block encryption procedure.
2. Description of the Related Art
Cryptographic systems are well known in the data processing art. In general, such systems operate by performing an encryption operation on a plaintext input block, using an encryption key, to produce a ciphertext output block. The receiver of an encrypted message performs a corresponding decryption operation, using a decryption key, to recover the plaintext block.
Encryption systems fall into two general categories: asymmetric encryption systems and symmetric encryption systems. Asymmetric (or public key) encryption systems use different keys that are not feasibly derivable from one another for encryption and decryption. A person wishing to receive messages generates a pair of corresponding encryption and decryption keys. The encryption key is made public, while the corresponding decryption key is kept secret. Anyone wishing to communicate privately with the receiver may encrypt a message using the receiver's public key. Only the receiver may decrypt the message, however, since only he has the private key. Perhaps the best-known asymmetric encryption system is the RSA encryption system, named after its originators Rivest, Shamir and Adleman and described in B. Schneier, Applied Cryptography (1996), pages 466-474, incorporated herein by reference.
Symmetric (or private key) encryption systems, on the other hand, use the same secret key for both encrypting and decrypting messages. Although symmetric encryption systems require some secure means for distributing or agreeing upon secret encryption keys, they continue to be preferred for many applications because of their relative computational efficiency.
Perhaps the best-known symmetric encryption system is the Data Encryption Algorithm (DEA), implementing the Data Encryption Standard (DES) as described in the National Institute of Standards and Technology (NIST) publications "Data Encryption Standard (DES)", FIPS PUB 46-2 (1980), and "DES Modes of Operation", FIPS PUB 81 (1988). In the DES system, a 64-bit key is used to transform a plaintext message comprising one or more 64-bit plaintext blocks into a ciphertext message comprising a like number of 64-bit ciphertext blocks, or vice versa. (56 bits of the key are independently specifiable, while the remaining 8 bits provide a parity check.)
As described in the latter FIPS publication, there are several defined modes of DES encryption. In the Electronic Codebook (ECB) mode, each plaintext block is encrypted independently of any other plaintext block. In the Cipher Block Chaining (CBC) mode of operation, on the other hand, each plaintext block is XORed with the previous ciphertext block (or with an initialization vector in the case of the first block) before being encrypted to hide plaintext patterns and thus provide more resistance to certain types of cryptanalytic attacks.
At the time of its initial promulgation, the 56-bit key length and 64-bit block length of DES were thought to provide adequate protection against cryptographic attacks, including key exhaustion attacks based upon systematically testing all possible keys and dictionary attacks based upon building a "dictionary" of corresponding plaintext and ciphertext blocks. However, continued advances in computing speed make such brute-force attacks increasingly more feasible.
The National Institute of Standards and Testing (NIST) has called for a complete replacement of DES, to be deployed sometime in the future. In the meantime, however, there is a significant investment by users in cryptographic hardware and software based on DES. Any replacement cryptosystem that is deployed in the interim would desirably build upon this existing DES infrastructure.